Contao Cross-Site Scripting Vulnerability in Template Output

A cross-site scripting vulnerability has been identified in Contao versions 4.0.0 prior to 4.13.57, 5.3.42 prior to 5.6.5. This issue allows code injection into template outputs, which is then executed in the browser on both the front end and back end. The vulnerability arises from certain templates that do not properly sanitize output, enabling the execution of injected code.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can upgrade to Contao versions 4.13.57, 5.3.42, or 5.6.5 to address this vulnerability. Alternatively, affected templates can be manually patched or not used at all.